Businesses risk N10m fine for non-compliance with data protection audit

Businesses whose primary role is linked with data control and processing are now required to conduct data protection compliance audits or risk a fine of N10millin or 2% of annual gross revenue, The Nation can authoritatively report.

From available information, the Nigeria Data Protection Act (NDPA) mandates that all Data Controllers and Processors of Major Importance conduct an annual Data Protection Compliance Audit and file their returns with the Commission within the Q1 window.

Besides, the official commencement of the Audit Season provides an ideal window for a thorough data protection review. By initiating the process early, organisations can ensure their assessments are exhaustive and stress-tested. This is particularly vital this year, as the NDPC has signalled increased oversight and more rigorous penalties for non-compliance.

Specifically, the Nigeria Data Protection Commission (NDPC) has signaled stricter enforcement this year, with penalties for non-compliance reaching up to ₦10 million or 2% of annual gross revenue.

Expatiating, Amoo Francis, a data analyst, reiterated that Nigeria’s data protection compliance is now governed by the Nigeria Data Protection Act (NDPA) 2023 and the effective General Application and Implementation Directive (GAID) 2025, which replaced the old NDPR and provides concrete rules for compliance, including mandatory registration for major processors, Data Protection Officer (DPO) requirements, Data Protection Impact Assessments (DPIAs), and stricter breach reporting, signaling a shift to active enforcement with penalties for non-compliance, note Afriwise, Mondaq, Andersen in Nigeria, and Chambers and Partners.

According to him, key changes include defined roles for DPOs, expanded definitions for “Data Controllers/Processors of Major Importance,” and new mechanisms for cross-border data transfers and data subject redress. “The General Application and Implementation Directive (GAID) became effective in September 2025, providing the operational roadmap for the NDPA and superseding the former NDPR.”

The NDPC is actively enforcing compliance, issuing notices, and imposing penalties, requiring companies to conduct gap analyses and update policies immediately.

Lending credence to the foregoing, Mikun Adeseyoju of DataPro Nigeria Limited, a leading compliance solutions and technology-driven rating agency in Nigeria, advised companies to ensure they factor audit of their data protection into their work plan early in the year.

“Do not just tick the box; ensure true resilience. At DataPro, we believe in “Practice over Theory.” As a licensed Data Protection Compliance Organisation (DPCO) celebrating over 30 years of excellence (1995–2026), we do not just help you file a report; we ensure you meet all regulatory requirements while strengthening your data protection framework. We will assist your organisation in developing, documenting, and compiling all the required information for submission.

“Our NDPA Audit Service covers risk identification, uncovering hidden vulnerabilities in your data processes, and with our remediation process we hope to deploy practical steps to fix gaps before the regulator sees them and also guarantee compliance assurance by ensuring your 2026 Audit Report is filed accurately and on time.”